User Subtype Messages

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
User Subtype Messages	Base Rule	User Information	Information
User Logon	Sub Rule	User Logon	Authentication Success
User Logon	Sub Rule	User Logon	Authentication Success
User Logoff	Sub Rule	User Logoff	Authentication Success
User Logout	Sub Rule	User Logoff	Authentication Success
Authentication Timed Out	Sub Rule	Authentication Timeout	Other Audit

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
logid	<vmid>	Number	The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.
level	<severity>	Text\String	Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.
srcip	<sip>	IP Address	IP address of the traffic’s origin.
user	<login>	Text\String	N/A
server	<domainorigin>	Text\String	N/A
msg	<object>	Text\String	N/A
logdesc	<subject> <vendorinfo>	Text\String	N/A
group	<group>	Text\String	N/A
action	<command>	Text\String	N/A
status	<status> <tag1>	Text\String	N/A